We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fileinfo is unable to recognize ordinal numbers of some delayed imports in PE files.
fileinfo
Run
$ retdec-fileinfo -v FILE
where FILE is
FILE
C200FBAF67E5DCA8633415FC1216BF3CF75C600DE7E922CA74113B70852D0A85
CB203F39DC633F086AD9578F463B631C4C9F5B51A3010A9770E9F2DBCD58482A
F7D3A288054712A571A20483B88D4604A4E94787AEF1433C681AC83824679B94
06FFCA20624E5571F71F54E80AA470A0E23171A2BDB2ED2B0FE706A42BA754B9
Import table ------------ Number of imports: 330 ... i name libName ordNum address ---------------------------------------------------------------------------------------- ... 254 msi.dll 0x441922 255 msi.dll 0x441918 256 msi.dll 0x44190e 257 msi.dll 0x44192c 258 msi.dll 0x4418fa 259 msi.dll 0x4418f0 260 msi.dll 0x4418e6 261 msi.dll 0x441936 262 msi.dll 0x441940 263 msi.dll 0x44194a 264 msi.dll 0x441954 265 msi.dll 0x44195e 266 msi.dll 0x44197c 267 msi.dll 0x441972 268 msi.dll 0x441968 269 msi.dll 0x441904 270 msi.dll 0x42f15f 271 msi.dll 0x42f155 272 msi.dll 0x42f14b 273 msi.dll 0x42f141 274 msi.dll 0x42f126 ...
As you can see, there are no names or ordinal numbers for the above imports.
pefile is able to recognize ordinal numbers for the above imports:
[IMAGE_DELAY_IMPORT_DESCRIPTOR] 0x49D04 0x0 grAttrs: 0x1 0x49D08 0x4 szName: 0x424A0 0x49D0C 0x8 phmod: 0x4EAA0 0x49D10 0xC pIAT: 0x4EA48 0x49D14 0x10 pINT: 0x4AA8C 0x49D18 0x14 pBoundIAT: 0x4AF1C 0x49D1C 0x18 pUnloadIAT: 0x0 0x49D20 0x1C dwTimeStamp: 0x0 [Thu Jan 1 00:00:00 1970 UTC] msi.dll Ordinal[32] (Imported by Ordinal) Bound: 0x00441922 msi.dll Ordinal[186] (Imported by Ordinal) Bound: 0x00441918 msi.dll Ordinal[171] (Imported by Ordinal) Bound: 0x0044190E msi.dll Ordinal[159] (Imported by Ordinal) Bound: 0x0044192C msi.dll Ordinal[24] (Imported by Ordinal) Bound: 0x004418FA msi.dll Ordinal[92] (Imported by Ordinal) Bound: 0x004418F0 msi.dll Ordinal[205] (Imported by Ordinal) Bound: 0x004418E6 msi.dll Ordinal[160] (Imported by Ordinal) Bound: 0x00441936 msi.dll Ordinal[17] (Imported by Ordinal) Bound: 0x00441940 msi.dll Ordinal[125] (Imported by Ordinal) Bound: 0x0044194A msi.dll Ordinal[20] (Imported by Ordinal) Bound: 0x00441954 msi.dll Ordinal[141] (Imported by Ordinal) Bound: 0x0044195E msi.dll Ordinal[90] (Imported by Ordinal) Bound: 0x0044197C msi.dll Ordinal[67] (Imported by Ordinal) Bound: 0x00441972 msi.dll Ordinal[118] (Imported by Ordinal) Bound: 0x00441968 msi.dll Ordinal[48] (Imported by Ordinal) Bound: 0x00441904 msi.dll Ordinal[8] (Imported by Ordinal) Bound: 0x0042F15F msi.dll Ordinal[204] (Imported by Ordinal) Bound: 0x0042F155 msi.dll Ordinal[113] (Imported by Ordinal) Bound: 0x0042F14B msi.dll Ordinal[16] (Imported by Ordinal) Bound: 0x0042F141 msi.dll Ordinal[70] (Imported by Ordinal) Bound: 0x0042F126
We should be able to do the same.
master
The text was updated successfully, but these errors were encountered:
Fixed in commit: ba7787d
Sorry, something went wrong.
ladislav-zezula
No branches or pull requests
fileinfo
is unable to recognize ordinal numbers of some delayed imports in PE files.Input
Run
where
FILE
isC200FBAF67E5DCA8633415FC1216BF3CF75C600DE7E922CA74113B70852D0A85
CB203F39DC633F086AD9578F463B631C4C9F5B51A3010A9770E9F2DBCD58482A
F7D3A288054712A571A20483B88D4604A4E94787AEF1433C681AC83824679B94
06FFCA20624E5571F71F54E80AA470A0E23171A2BDB2ED2B0FE706A42BA754B9
Output
As you can see, there are no names or ordinal numbers for the above imports.
Expected output
pefile is able to recognize ordinal numbers for the above imports:
We should be able to do the same.
Configuration
master
)The text was updated successfully, but these errors were encountered: